1 简述

TCP wrappers is a simple tool to block incoming connection on application level. This was very useful 20 years ago, when there were no firewalls in Linux. This is not the case for today and connection filtering should be done in network level or completely in application scope if it makes sense. After recent discussions I believe it is time to go for this package, if not completely, than at least as a dependency of modern daemons in system by default.

2 详细描述

The last version of tcp_wrappers was released 20 years ago (although IPv6 support was added later). At that time it was very powerful tool to "block all traffic", but these days we can do the same thing using firewalls/iptables/nftables for all traffic on network level or use similar filtering at the application level.

One of the motivating factors for this change was the removal of TCP wrappers support from systemd and OpenSSH in 2014, based on the thread on fedora devel list [1]. Another thread was started during 2017 [2] which is trying to explain the reasons why we should do that with other constructive ideas.

Another factor which has driven the deprecation of this package is the lack of any upstream community around it. Although the threats on networking communications continually increase, the threat coverage of this package has remained the same over the last two decades, leading one to draw the inference that new threats are now being handled by different components.

3 升级影响

Updating from older versions might expose existing services "protected" by tcp_wrappers before (sshd). The removal needs to be explicitly mentioned in the migration guide/release notes so the users are able to configure different layer of security (firewalld, application configuration) if this was the only one they used.

4 替代方案

After removing the libwrap dependency from openssh, it will stop using rules defines in /etc/hosts.deny. The functionality can be "added back" if needed to any socket-activated service. For example SSHD:

  • Disable sshd.service
systemctl disable sshd
  • Copy the shipped sshd@.service to /etc:
cp {/usr/lib,/etc}/systemd/system/sshd@.service
  • Modify the ExecStart line in the above file under /etc/ from
ExecStart=-/usr/sbin/sshd -i $OPTIONS $CRYPTO_POLICY

to

ExecStart=@-/usr/sbin/tcpd /usr/sbin/sshd -i $OPTIONS $CRYPTO_POLICY
  • Reload systemctl
systemctl daemon-reload
  • Enable and start sshd.socket
systemctl enable sshd.socket
systemctl start sshd.socket
  • Verify that you can connect to new service (not working now, because it is blocked by SELinux). Blocked by the bug #1482554 [3].

A similar approach can be used for other services to drop the tcp_wrappers dependency.

参考链接:

https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers

https://serverfault.com/questions/869431/openssh-removed-support-for-tcp-wrappers-now-what-no-hosts-allow-for-ssh-acce

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/UOAUI4TC6PQVHRJ2ONQ2N3IKHR4577VH/    废弃后如何实现原有功能

为什么tcp-wrappers被Redhat Centos Fedora废弃?的更多相关文章

  1. Fedora Redhat Centos 有什么区别和关系?

    Fedora Redhat Centos 有什么区别和关系? 经常看到有人讨论服务器的操作系统,比如 Readhat 和 Centos,还有 Ubuntu Server. 可能 Ubuntu Serv ...

  2. CentOS 访问控制列表(tcp wrappers)

    1.TCP Wrappers是一个工作在应用层的安全工具,它只能针对某些具体的应用或者服务起到一定的防护作用.比如说ssh.telnet.FTP等服务的请求,都会先受到TCP Wrappers的拦截. ...

  3. 在RedHat/CentOS下安装Docker(不升级内核)

    由于内核版本问题,最初仅Ubuntu可以较好的支持Docker.不过,由于RedHat系列OS(REHL.CentOS)是目前主流的Linux服务器操作系统,所以令RedHat系列OS支持Docker ...

  4. RHEL/CentOS/Fedora各种源(EPEL、Remi、RPMForge、RPMFusion)配置

    最新文章:Virson’s Blog CentOS默认自带CentOS-Base.repo源,但官方源中去除了很多有版权争议的软件,而且安装的软件也不是最新的稳定版.Fedora自带的源中也找不到很多 ...

  5. Install MongoDB on Red Hat Enterprise, CentOS, Fedora, or Amazon Linux

    Install MongoDB on Red Hat Enterprise, CentOS, Fedora, or Amazon Linux¶ Overview Use this tutorial t ...

  6. RHEL/CentOS/Fedora常用的 CentOS 5/6/7 yum 源(EPEL、Remi、RPMForge、RPMFusion, ius,163,sohu,阿里云)配置

    RHEL以及他的衍生发行版如CentOS.Scientific Linux为了稳定,官方的rpm repository提供的rpm包往往是很滞后的,当然了,这样做这是无可厚非的,毕竟这是服务器版本,安 ...

  7. Linux下载_Linux系统各种版本ISO镜像下载(redhat,centos,oracle,ubuntu,openSUSE)

    以下是风哥收集的Linux系统各种版本ISO镜像下载,包括redhat,centos,oracle,ubuntu等linux操作系统. Linux下载1:红帽RedHat Linux(RHEL5.RH ...

  8. RHEL/CentOS/Fedora各种源

    CentOS 默认自带 CentOS-Base.repo 源, 但官方源中去除了很多有版权争议的软件, 而且安装的软件也不是最新的稳定版. Fedora 自带的源中也找不到很多多媒体软件, 如果需要安 ...

  9. Docker运行操作系统环境(BusyBox&Alpine&Debian/Ubuntu&CentOS/Fedora)

    目前常用的Linux发行版主要包括Debian/Ubuntu系列和CentOS/Fedora系列.前者以自带软件包版本较新而出名:后者则宣称运行更稳定一些.选择哪个操作系统取决于读者的具体需求.同时, ...

随机推荐

  1. 【Vue 2.X】基于ElementUI 实现 dialog弹窗移动效果-自定义指令系列(二)

    v-dialogDrag: 弹窗拖拽 使用: <el-dialog XXX v-dialogDrag></el-dialog> Vue.directive('dialogDra ...

  2. Java源码之ArrayList分析

    一.ArrayList简介 ArrayList底层的数据结构是数组,数组元素类型为Object类型,即可以存放所有类型数据. 与Java中的数组相比,它的容量能动态增长.当创建一个数组的时候,就必须确 ...

  3. vue-froala-wysiwyg 富文本编辑器

    近期需要在vue3项目上做一个富文本编辑器,找了很多插件组件,最终决定用 froala.虽然不是免费的,但是功能实在是太强大了. froala 文档:https://www.froala.com/wy ...

  4. ajax_封装函数_步骤1

    <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8& ...

  5. c++求中位数

    #include <iostream> #include <cassert> #include <stack> #include <math.h> us ...

  6. 4——class和struct

    class的定义看上去很像struct定义的扩展, 事实上,类定义时的关键字class完全可以替换成struct,也就是说,结构体变量也可以有成员函数. class和struct的唯一区别在于:str ...

  7. Dev控件

    在DevExpress程序中使用PopupContainerEdit和PopupContainer实现数据展示 使用PopupContainerEdit和PopupContainerControl制作 ...

  8. 特朗普或出席!富士康耗资100亿美元建LCD液晶面板厂

    富士康建液晶工厂,富士康科技集团发言人证实,富士康科技集团将于今年6月28日耗资100亿美元的LCD面板厂举行动工仪式. 富士康周四表示,他已经了解到,仪式将于今年6月28日举行,包括美国总统特朗普总 ...

  9. autoit3 脚本自动安装实例

    软件自动安装的相关实例!贴出来用于参考,并部分相关语法与示例 #RequireAdmin If DriveMapGet("T:")=="" Then Drive ...

  10. Vue通信的10种方式

    1.10种通信方式 10种:https://juejin.im/post/5bd18c72e51d455e3f6e4334 2.除此之外,还有children和ref. 需要注意 $children  ...